Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 08:41
Behavioral task
behavioral1
Sample
Proof of payment.jar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Proof of payment.jar
Resource
win10v2004-20240508-en
General
-
Target
Proof of payment.jar
-
Size
124KB
-
MD5
7bf4527b293b0c3f6cc8859886d6c9d8
-
SHA1
75183471ffca124e8ead875329cc6fcd6492e2c8
-
SHA256
48f6788ba8e0405098152cd2417e68fdb87bfc41665ead3883f1b0d67fec202a
-
SHA512
d25e0c208cd4959779fa90d0a686dae65b290ac8062564f40044fa656a8901cddd7f0084544c265c4ccd4978f42c9248184c07801ccdc5b8ddf1d53983515ee8
-
SSDEEP
1536:m2JqdLhOqhzbqA4LOcKgoWrQj0oU1BlKE6tcj871PSMQeyd8qyLBq8eGk1FOX:qdcW6A4LOc1RQyXQ08ZPAytyOX
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
java.exewscript.exedescription pid process target process PID 1636 wrote to memory of 2716 1636 java.exe wscript.exe PID 1636 wrote to memory of 2716 1636 java.exe wscript.exe PID 1636 wrote to memory of 2716 1636 java.exe wscript.exe PID 2716 wrote to memory of 2064 2716 wscript.exe javaw.exe PID 2716 wrote to memory of 2064 2716 wscript.exe javaw.exe PID 2716 wrote to memory of 2064 2716 wscript.exe javaw.exe
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Proof of payment.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript C:\Users\Admin\iaoojnaujn.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\dxrsyuyhc.txt"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dxrsyuyhc.txtFilesize
92KB
MD558a86baacf10b0e009cda66f13f44e00
SHA10530d246742452aa2a8b1096233c81c73dc67668
SHA256188490d674620e42560d91bca3a8b6bf3fd56279d109f6458e01db431e553c3e
SHA5129efcee479fdb05499af11ff7146ae675bdf633dcaa1d3ec55396ceace083f20ddb5fbc0bc5d011b0d3246762e57a292b1451a56b79e86cbb8be7fa4641cebe1c
-
C:\Users\Admin\iaoojnaujn.jsFilesize
209KB
MD53c998a1eb4061c8324d11175722ceaad
SHA1db712475af068245090102a84665da5043ac40ad
SHA256ec3324e7d3fc372b121ce644b6a44466bc58757a666b8f9c2c5584655ab72a40
SHA5125b671101eba9cacaee7ceaf8e9d6328e5364b82b5d37089eee8fbe8deb68065ddd5bce52e345040b7ec4570df8868c86880b63d3eab2f5cbca01a812658144bb
-
memory/1636-2-0x0000000002550000-0x00000000027C0000-memory.dmpFilesize
2.4MB
-
memory/1636-12-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1636-14-0x0000000002550000-0x00000000027C0000-memory.dmpFilesize
2.4MB
-
memory/2064-27-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2064-19-0x0000000002660000-0x00000000028D0000-memory.dmpFilesize
2.4MB
-
memory/2064-34-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2064-40-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2064-46-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2064-49-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2064-57-0x0000000002660000-0x00000000028D0000-memory.dmpFilesize
2.4MB
-
memory/2064-61-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2064-64-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2064-79-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB